Network-based systems and applications are susceptible to attacks by malicious users (e.g., hackers). Penetration testing (also referred to as pentesting) is conducted to attack systems and applications in an effort to find security holes, which can be exploited by malicious users. In general, penetration testing simulates attacks malicious users could attempt. During penetration testing, a series of tasks is performed in an effort to achieve a goal. A task can be performed using a respective tool (e.g., provided as one or more computer-executable programs), a subset of a tool, and/or by the tester writing a custom tool. Consequently, executing a penetration test can include running a set of tools in a specified order and, based on their outcomes, run further testing tools until a goal is reached, or failure occurs.
Attack trees are diagrams depicting how an asset might be attacked. Attack trees can be used in penetration testing as an efficient way to make the testing transparent and repeatable. During the course of a penetration test, an initial attack tree can be altered to account for other attack paths not provided for in the initial attack tree. Generating attack trees for specific systems can be inefficient and time consuming, and the quality of the attack tree can vary. In some cases, attack trees are manually generated by system experts (e.g., users knowledgeable about system details). In general, the quality of the attack tree is as good as the quality of the user, who manually models the system.